API reference

168 operations across 21 areas. Generated from the OpenAPI document, which is generated from the schemas the API validates with — so a field here cannot disagree with the API.

Base URL https://api.haavisa.com. All requests and responses are JSON. Send your key as Authorization: Bearer or x-api-key.

Requirements

Eligibility and the rules behind it.

post/v1/checkAPI key

Does this traveller need a visa for this destination?

post/v1/check/batchAPI key

A manifest: many travellers in one request

get/v1/checks/{requestId}API key

What we answered, and the statute behind it

Products

The catalogue of purchasable products.

get/v1/productsAPI key

List visa products

get/v1/products/{code}API key

Fetch one product by code

get/v1/purposesAPI key

The reasons for travel a destination’s form offers

get/v1/service-tiersAPI key

List service tiers

Applications

The draft, submission and decision lifecycle.

get/v1/applicationsAPI key

List applications

post/v1/applicationsAPI key

Create an application on behalf of a traveller

delete/v1/applications/{id}API key

Delete a draft

get/v1/applications/{id}API key

Fetch one application

patch/v1/applications/{id}API key

Autosave a draft

get/v1/applications/{id}/requirementsAPI key

Read non-file requirement records

put/v1/applications/{id}/requirementsAPI key

Provide a host code or insurance reference

post/v1/applications/{id}/submitAPI key

Submit to the destination authority

get/v1/applications/{id}/timelineAPI key

What has happened to this application

post/v1/applications/lookupAPI key

Look up an application by reference and email

Health

Unauthenticated liveness and readiness.

get/healthNone — public

Liveness

get/metricsAPI key

Queue depths, for a scraper

get/readyNone — public

Readiness

JSON:API

The `/v3` surface. The same questions as `/v1` in the envelope another provider’s clients already parse — `{ meta, data: [{ id, type, attributes }] }` and JSON:API error documents. A separate version rather than content negotiation, because those clients send no `Accept` header to negotiate with.

get/v3/countriesAPI key

Countries, in JSON:API

get/v3/countries/{iso3}API key

One country, in JSON:API

get/v3/proceduresAPI key

What a traveller must do to enter a destination

get/v3/procedures/{id}API key

One procedure, by destination-nationality

post/v3/tripsAPI key

An itinerary, answered leg by leg

post/v3/trips/llmAPI key

The same trip, with a quotable answer per leg

get/v3/webhooksAPI key

Webhook subscriptions

post/v3/webhooksAPI key

Subscribe a URL

delete/v3/webhooks/{id}API key

Unsubscribe

get/v3/webhooks/{id}API key

One webhook

patch/v3/webhooks/{id}API key

Update a webhook

Reference

Captured government reference data — ports, airlines, countries, document requirements. Read-only, and each response carries the capture it came from.

get/v1/airlinesAPI key

Airline roster for a destination

get/v1/airportsAPI key

Search airports

get/v1/airports/{iata}API key

Fetch one airport by IATA code

get/v1/citiesAPI key

Search cities, one entry per place

get/v1/countriesAPI key

Countries, with the adjective for each nationality

get/v1/documentsAPI key

Supporting documents an application will ask for

get/v1/entry-pointsAPI key

Ports of entry, joined to the airports behind them

get/v1/form-fieldsAPI key

The questions a destination’s application form asks

get/v1/geo/locationAPI key

Coarse location from the request

get/v1/portsAPI key

Points of entry for a destination

Partner

Partner self-service. Scoped to the calling key’s own tenant.

get/v2/keysAPI key

List this tenant’s API keys

post/v2/keysAPI key

Issue an API key

delete/v2/keys/{prefix}API key

Revoke an API key

get/v2/meAPI key

Identify the calling tenant and key

get/v2/reports/applicationsAPI key

Application volumes for a month

get/v2/reports/usageAPI key

Metered usage for a month

get/v2/teamAPI key

List this tenant’s portal users

post/v2/teamAPI key

Invite a colleague

Billing

Statements of charges, computed from the ledger.

get/v2/invoicesAPI key

Recent statements

get/v2/invoices/{period}API key

One month’s statement

Partner auth

Sign-in for the partner portal. Public by necessity — a browser has no API key.

post/v2/auth/logoutNone — public

Sign out

post/v2/auth/magic-linkNone — public

Email a sign-in link

get/v2/auth/sessionNone — public

Who the session cookie belongs to

post/v2/auth/verifyNone — public

Exchange a sign-in token for a session

Webhooks

Partner-facing event delivery. Signed, retried, and logged.

get/v2/webhook-endpointsAPI key

List this tenant’s webhook endpoints

post/v2/webhook-endpointsAPI key

Register a webhook endpoint

delete/v2/webhook-endpoints/{id}API key

Delete an endpoint

get/v2/webhook-endpoints/{id}API key

Fetch one endpoint

patch/v2/webhook-endpoints/{id}API key

Update an endpoint

get/v2/webhook-endpoints/{id}/deliveriesAPI key

Delivery log

post/v2/webhook-endpoints/{id}/rotate-secretAPI key

Rotate the signing secret

get/v2/webhook-eventsAPI key

The event vocabulary

Documents

Presigned upload, async validation, and short-lived retrieval.

get/v1/applications/{id}/documentsAPI key

List an application’s documents

post/v1/applications/{id}/documentsAPI key

Ask for somewhere to put a file

delete/v1/documents/{id}API key

Remove a document before submission

post/v1/documents/{id}/completeAPI key

Report that an upload finished, and get the verdict

get/v1/documents/{id}/urlAPI key

A short-lived link to a stored document

post/v1/documents/mrzAPI key

Read a passport page's machine-readable zone

post/v1/documents/photoAPI key

Render a correctly sized passport photograph

get/v1/storage/localNone — public

Read one object (local storage driver)

put/v1/storage/localNone — public

Upload one object (local storage driver)

Payments

Provider selection, authorisation and provider callbacks.

post/v1/captureAPI key

Authorise payment for an application

get/v2/providersAPI key

Payment providers available for a corridor

post/v2/webhooks/{provider}None — public

Payment provider callback

Admin

Internal. Requires `projects:write`, which no partner key is ever issued.

get/v1/admin/activityAPI key

Search the audit log

get/v1/admin/applicant-usersAPI key

Search the applicant directory

post/v1/admin/applicantsAPI key

Create an applicant account by hand

get/v1/admin/applicationsAPI key

The operations queue

get/v1/admin/applications/{id}API key

One application in full

post/v1/admin/applications/{id}/decision-documentAPI key

Attach an authority decision PDF

post/v1/admin/applications/{id}/documents-requestAPI key

Ask the applicant for more documents

post/v1/admin/applications/{id}/documents-request/{requestId}/reviewAPI key

Accept, reject or cancel a requested replacement

get/v1/admin/applications/{id}/documents/{documentId}API key

Fetch one uploaded application document

post/v1/admin/applications/{id}/emailAPI key

Email the applicant about their application

get/v1/admin/applications/{id}/evidence/{filename}API key

Fetch one submission evidence screenshot

post/v1/admin/applications/{id}/government-paymentAPI key

Hand the government its fee

post/v1/admin/applications/{id}/government-payment/recordAPI key

Record a portal quote, uncertain payment, receipt or reconciliation

post/v1/admin/applications/{id}/requirements/reviewAPI key

Verify a requirement or record an evidenced exemption

post/v1/admin/applications/{id}/status-checkAPI key

Ask the portal about this application now

post/v1/admin/applications/{id}/submissionAPI key

Record a government submission

post/v1/admin/applications/{id}/submission/enqueueAPI key

Queue a browser submission

get/v1/admin/applications/{id}/timelineAPI key

Everything that happened to one application

get/v1/admin/automationAPI key

Read submission and status-check queues

get/v1/admin/customersAPI key

Search applicant customers

get/v1/admin/customers/{id}API key

One applicant account, with the applications it owns

post/v1/admin/customers/{id}/verification-emailAPI key

Re-send the address-verification email

get/v1/admin/documentsAPI key

List applicant documents

get/v1/admin/government-paymentsAPI key

List government fee handoffs

get/v1/admin/mailboxAPI key

List messages from a Postern inbox

get/v1/admin/mailbox/{source}/{messageId}API key

Read a matched Postern message

get/v1/admin/notificationsAPI key

Messages that did not land

post/v1/admin/notifications/{id}/requeueAPI key

Put one message back in the worker’s path

get/v1/admin/operatorsAPI key

List operations team access

post/v1/admin/operatorsAPI key

Add an operations user

patch/v1/admin/operators/{email}API key

Change an operations role or access state

post/v1/admin/operators/{email}/invitationAPI key

Re-send an operator’s invitation

get/v1/admin/operators/authorization/{email}API key

Resolve an operations user

get/v1/admin/payment-recoveryAPI key

List abandoned payment attempts

post/v1/admin/payment-recovery/{id}/remindAPI key

Send a checkout reminder

get/v1/admin/paymentsAPI key

Recent payments

patch/v1/admin/products/{code}/availabilityAPI key

Show or hide one product

patch/v1/admin/products/{code}/pricingAPI key

Update a product government fee

patch/v1/admin/service-tiers/{id}/pricingAPI key

Update a service tier fee

get/v1/admin/statsAPI key

Queue and revenue totals

post/v1/admin/stripe/catalog/syncAPI key

Push the catalogue and service tiers to Stripe

get/v1/admin/system/submission-workerAPI key

Read the submission worker control

patch/v1/admin/system/submission-workerAPI key

Enable or pause government submission processing

get/v1/admin/visa-dataAPI key

Read visa data and price catalogue

patch/v1/admin/visa-data/{destination}/availabilityAPI key

Show or hide every product for one destination

post/v1/admin/visa-data/{destination}/requirementsAPI key

Publish a new version of a destination’s document requirements

post/v1/admin/visa-data/{destination}/sourcesAPI key

Add a visa data source

delete/v1/admin/visa-data/sources/{id}API key

Remove a visa data source

patch/v1/admin/visa-data/sources/{id}API key

Update a visa data source

get/v1/checkout-returnAPI key

Resolve a Stripe checkout return

get/v1/rules/freshnessAPI key

Which eligibility answers are past their re-verification cadence

get/v2/projectsAPI key

List tenants

post/v2/projectsAPI key

Create a tenant

get/v2/projects/{id}API key

Fetch a tenant and its keys

put/v2/projects/{id}API key

Reconfigure a tenant

delete/v2/projects/{id}/keys/{prefix}API key

Revoke any tenant’s key

get/v2/projects/{id}/usersAPI key

List a tenant’s portal users

post/v2/projects/{id}/usersAPI key

Invite a partner user

Support

get/v1/admin/support/ticketsAPI key

Manage support tickets

get/v1/admin/support/tickets/{id}API key

Manage support tickets

patch/v1/admin/support/tickets/{id}API key

Manage support tickets

post/v1/admin/support/tickets/{id}/messagesAPI key

Manage support tickets

post/v1/contactAPI key

Send a message from the contact form

get/v1/support/ticketsAPI key

Read or write your own support tickets

post/v1/support/ticketsAPI key

Read or write your own support tickets

get/v1/support/tickets/{id}API key

Read or write your own support tickets

post/v1/support/tickets/{id}/messagesAPI key

Read or write your own support tickets

Account

get/v1/applications/mineapplicantSession

List the signed-in applicant’s own applications

Rules

get/v1/rules/exportAPI key

The whole rule set, for a partner to hold locally

Accounts

post/v1/tokenNone — public

Issue or refresh a session

get/v1/token/introspectNone — public

Check whether the caller holds a valid session

post/v1/token/mfaNone — public

Complete the second factor

post/v1/token/revokeNone — public

Revoke a session

post/v2/accountsNone — public

Register an applicant account

get/v2/accounts/meNone — public

The signed-in applicant

patch/v2/accounts/meNone — public

Update the signed-in applicant

get/v2/accounts/me/messaging-consentNone — public

May we message this number?

put/v2/accounts/me/messaging-consentNone — public

Record a messaging opt-in or opt-out

post/v2/accounts/mfa/activateNone — public

Confirm and enable two-factor authentication

post/v2/accounts/mfa/disableNone — public

Disable two-factor authentication

post/v2/accounts/mfa/enrollNone — public

Begin two-factor enrolment

post/v2/accounts/password-resetNone — public

Ask for a password-reset link

post/v2/accounts/password-reset/confirmNone — public

Set a password from a mailed link

post/v2/accounts/sign-inNone — public

Sign in to the applicant wizard

post/v2/accounts/sign-outNone — public

Sign out of the applicant wizard

post/v2/accounts/verify-emailNone — public

Confirm an email address

post/v2/accounts/verify-email/resendNone — public

Send the confirmation link again

Messaging

post/v2/messaging/{provider}/inboundNone — public

Inbound messaging callback (STOP / START)

Analytics

post/v2/trackAPI key

Ingest analytics events

Notifications

post/v2/webhooks/emailNone — public

Email delivery callback (delivered / bounced / complained)

get/v2/webhooks/whatsappNone — public

WhatsApp webhook verification handshake

post/v2/webhooks/whatsappNone — public

WhatsApp delivery receipts and inbound replies